Move secret token to app config and ignore app config